US20020194495A1 - Stateful distributed event processing and adaptive security - Google Patents
Stateful distributed event processing and adaptive security Download PDFInfo
- Publication number
- US20020194495A1 US20020194495A1 US10/172,305 US17230502A US2002194495A1 US 20020194495 A1 US20020194495 A1 US 20020194495A1 US 17230502 A US17230502 A US 17230502A US 2002194495 A1 US2002194495 A1 US 2002194495A1
- Authority
- US
- United States
- Prior art keywords
- node
- processing server
- state
- event processing
- network
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0254—Stateful filtering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
Definitions
- This invention relates to computer network security, and more particularly to methods and apparatus for securing one or more nodes on a computer network.
- Active security systems provide real-time barriers to intrusions, via software- or hardware-based pre-programmed intrusion detection measures.
- Passive systems provide the ability to detect and recover from previously observed security breaches, by examining data gathered about previous system access activity, so as to improve static access controls and policies over time. Active systems, then, function primarily to prevent intrusions, and passive systems function primarily to report on and examine data about previous intrusions to prevent future intrusions.
- Access control tools such as network firewalls
- Content filtering tools like computer virus scanners
- System auditing tools like reference monitors, may provide either stateless or state-based monitoring (such as the state-based monitoring provided by the stateful reference monitor described in U.S. patent application Ser. No. 10/071,328 and incorporated by reference herein) of individual workstations or servers, by identifying variations from either pre-determined settings or a dynamic machine state.
- Examples of conventional passive security systems include activity logging tools and auditing tools, which may be employed in conjunction with one another.
- Activity logging tools track the activity of one or more computers and transcribe observed system activity to a series of log files as individual entries.
- Auditing tools typically examine those log entries to discern breaches, attacks, or other potentially threatening activity, occurring either across machines or within individual machines.
- Both types of security systems provide useful intrusion detection and prevention functions. However, both generally rely on pre-programmed network administration policy, business rules, or other parameters, and so neither (particularly passive systems) provides the adaptation capability sometimes necessary to counter novel types of attacks as they occur. Also, conventional active systems are unable to observe and correlate seemingly innocuous activity as it occurs across nodes to determine that an intrusion is in progress. Given the growing ubiquity of computer networks and the value of electronic assets, commensurate growth of network security threats is to be expected. Therefore, a security system which provides adaptive countermeasures in real time to localized (i.e., limited to one node) or non-localized intrusions would provide tremendous value to operators of computer networks.
- a first embodiment of the invention provides a method of maintaining a networked computer system including first and second nodes and an event processing server, comprising the first and second nodes detecting changes in state, the event processing server receiving notification of the changes in state from the first and second nodes, the event processing server correlating changes in state detected in the first and second nodes, and the event processing server executing a maintenance decision which affects the first and second nodes, wherein the detecting, transmitting, correlating, and executing occurs without human intervention.
- This embodiment may be practiced wherein the changes in state are a result of at least one of an event and the absence of an event, wherein the changes in state are recognized by a reference monitor, and/or wherein the event processing server receiving the report is the result of one of the first and second nodes reporting to the event processing server and the event processing server polling the first and second nodes.
- the embodiment may further include the event processing server updating an operating policy on the network, and updating the operating policy may include at least one of requesting security policy changes on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters. At least one node may further enact the updated operating policy.
- the embodiment may further include notifying an external entity of actions taken, and the external entity may be a network administrator or a software application executing on the network.
- a second embodiment of the invention provides a method for maintaining a networked computer system including at least one node detecting a change in state, an event processing server on the network receiving notification of the at least one change in state from the at least one node, and the event processing server responding to the notification by executing a maintenance decision, wherein the detecting, receiving, and responding occurs without human intervention.
- This embodiment may be practiced wherein the change in state is a result of at least one of an event and the absence of an event, wherein the change in state is recognized by a reference monitor, wherein the event processing server receiving the report is the result of one of the node reporting to the event processing server and the event processing server polling the node, and may be practiced wherein the maintenance decision affects the at least one node detecting the change in state, and/or wherein the maintenance decision affects at least one node other than the node detecting the change in state.
- the embodiment may further include the event processing server updating an operating policy on the network, wherein updating the operating policy may include at least one of requesting security policy changes on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters.
- the embodiment may still further include at least one node enacting the updated operating policy, and/or notifying an external entity of actions taken, wherein the external entity is a network administrator or a software application executing on the network.
- a third embodiment of the invention provides a method for maintaining a node on a networked computer system including at least one node detecting a change in state, and the at least one node reacting to the change in state, wherein the at least one node detecting and reacting occurs without human intervention.
- the embodiment may be practiced wherein the change in state is a result of at least one of an event and the absence of an event, and/or wherein the change in state is recognized by a stateful reference monitor.
- the embodiment may further include at least one node notifying an event processing server on the network, the event processing server responding to the notification by updating an operating policy on the network, wherein updating the operating policy includes at least one of requesting updates to security policy on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters.
- the embodiment may further include the at least one node enacting the updated operating policy, and/or notifying an external entity of actions taken, wherein the external entity is a network administrator and/or a software application executing on the network.
- a fourth embodiment of the invention provides a computer-readable medium having instructions recorded thereon, which instructions, when executed, enable at least one processor in a networked computer system to detect a change in state of a node, and process instructions defining reacting to the detected change in state.
- the embodiment may further include instructions defining communicating the change in state to an event processing server, instructions defining processing maintenance instructions received from the event processing server, and/or instructions defining transmitting notification to a network administrator of actions taken.
- a fifth embodiment of the invention provides a computer-readable medium having instructions recorded thereon, which instructions, when executed, enable at least one processor in a networked computer system to maintain an operating policy for the network, receive notification of a change in state from at least one node, and update the operating policy based on the change in state.
- the embodiment may further include instructions defining storing received notifications of changes in state in memory, instructions defining correlating notifications received from a plurality of nodes, instructions defining storing received notifications in electronic file storage, and/or instructions defining notifying an external entity of actions taken, wherein the external entity is a network administrator or a software application executing on the network.
- a sixth embodiment of the invention provides a method for maintaining a networked computer system including at least one node detecting a change in state, an event processing server on the network receiving notification of the at least one change in state from the at least one node, and the event processing server responding to the notification by dispensing a maintenance decision.
- the embodiment may further comprise executing, by a human operator, the maintenance decision on at least one node on the networked computer system, or executing, without human intervention, the maintenance decision on at least one node on the networked computer system.
- a human operator may be prompted and allotted a predetermined period to execute the maintenance decision before it is executed without human intervention.
- FIG. 1 is a functional block diagram depicting the interaction of system components which define aspects of at least one embodiment of the invention
- FIG. 2 is a functional block diagram depicting the interaction of system components which define aspects of at least one other embodiment of the invention.
- FIG. 3 is a functional block diagram depicting the interaction of system components which define aspects of at least a third embodiment of the invention.
- FIG. 4 is a block diagram of an exemplary computer system on which aspects of embodiments of the invention may be implemented.
- FIG. 5 is a block diagram depicting exemplary computer system components with which aspects of embodiments of the invention may be implemented.
- aspects of embodiments of the present invention provide methods and apparatus for securing a networked computer system through the coordinated execution of reference monitor and event agent software on individual nodes, and event processing server software on a network server, for achieving active security measures, administrative control, and the ability to correlate potentially threatening activity across multiple nodes in real time.
- Computer system 400 shown in FIG. 4, with which aspects of these embodiments, either individually or in combination, may be implemented, may include at least one main unit connected to both one or more output devices 401 which store information, transmit information or display information to one or more users or machines, and one or more input devices 402 which receives input from one or more users or machines.
- the main unit may include one or more processors 403 connected to a memory system 404 via one or more interconnection mechanisms 405 , such as a bus or switch. Any input device 402 and/or output device 401 are also connected to the processor 403 and memory system 404 via the interconnection mechanism 405 .
- the computer system 400 may further include a storage system 406 in which information is held on or in a non-volatile medium. The medium may be fixed in the system or may be removable.
- computer system 400 may be distributed, and therefore may not include a main unit.
- input devices 402 , processors 403 , memory systems 404 , interconnection mechanisms 405 , and storage systems 406 may each comprise individual or multiple computer systems, and may be geographically disparate.
- storage systems 406 may comprise a server farm residing in New York which communicates with a processor 403 residing in Pennsylvania, via the Internet, which serves as interconnection mechanism 405 .
- Computer system 400 may be a general purpose computer system which is programmable using a computer programming language.
- Computer programming languages suitable for implementing such a system include procedural programming languages, object-oriented programming languages, combinations of the two, or other languages.
- the computer system may also be specially programmed, special purpose hardware, or an application specific integrated circuit (ASIC).
- ASIC application specific integrated circuit
- the processor In a general purpose computer system, the processor is typically a commercially available processor which executes a program called an operating system, which controls the execution of other computer programs and provides scheduling, debugging, input/output control, accounting, compilation, storage assignment, data management, memory management, communication control and related services.
- the processor and operating system defines the platform for which application programs in other computer programming languages are written. The invention is not limited to any particular processor, operating system or programming language.
- Storage system 406 typically includes a computer-readable and computer-writeable non-volatile recording medium 501 , in which data is stored that define a program to be executed by the processor, or information stored to be processed by the program.
- the medium may, for example, be a disk or flash memory.
- the processor causes data to be read from the nonvolatile recording medium 501 into another memory 502 that allows for faster access to the information by the processor than does the medium 501 .
- This memory 502 is typically a volatile, random access memory such as a dynamic random access memory (DRAM) or static memory (SRAM). It may be located in storage system 406 , as shown, or in memory system 404 , not shown.
- DRAM dynamic random access memory
- SRAM static memory
- the processor 403 generally manipulates the data within the integrated circuit memory 404 , 502 and then copies the data to the medium 501 after processing is completed.
- a variety of mechanisms are known for managing data movement between the medium 501 and the integrated circuit memory element 404 , 502 , and the invention is not limited thereto. The invention is not limited to a particular memory system 404 or storage system 406 .
- aspects of embodiments of the invention may be implemented in software, hardware or firmware, or any combination thereof.
- the various elements of an embodiment, either individually or in combination, may be implemented as a computer program product including a computer-readable medium, e.g. storage 406 , on which instructions are stored for access and execution by a processor, e.g. processor 403 . When executed by the processor 403 , the instructions instruct the processor 403 to perform the various steps of the process.
- FIG. 1 is a functional block diagram depicting the relationship between system components, such as those described above, adapted to enable aspects of embodiments of the invention.
- Reference Monitor 25 executes on Node A, which may be a workstation, server, or other computer on the network.
- Reference Monitor 25 may be a software application, which may execute on Node A synchronously, asynchronously, or both, providing continuous monitoring capability.
- Reference Monitor 25 may be adapted to execute on nodes running any commercially prevalent operating system such as UNIX, LINUX, Windows NT, and others.
- Reference Monitor 25 acts to detect and intercept local node operations and/or network-originated requests through which the operating system and/or user applications attempt to access system resources on the node.
- Reference Monitor 25 in order to monitor system events, Reference Monitor 25 comprises Interceptors 26 , which are inserted in the control or communication paths traversed by those events.
- an Interceptor 26 may be inserted in the operating system at a point where the network access request is communicated from one portion of the operating system to another. Interceptor 26 may generate an event message for each event intercepted. Event messages may then be communicated to Reference Monitor 25 , which may return a policy message to Interceptor 26 .
- the policy message may be an action for Interceptor 26 to take, such as allowing an access request event to continue along the control or communication path so that it has its intended effect, or not allowing the event to pass along the path.
- Reference Monitor 25 may instead, or also, construe the absence of an anticipated request for system resources as a harmful activity.
- Reference Monitor 25 may interpret an overall absence of event messages, of certain types of event messages, or of event messages received within a certain timeframe, for example, as cause to return a policy message to Interceptor 26 , such as an instruction to not to allow an event to continue along its intended path.
- Event Agent 45 also executes on Node A, and in this embodiment is a software application which executes continuously in the background on Node A.
- Event Agent 45 executes in conjunction with, and may be integrated with, Reference Monitor 25 and coordinates communication between Reference Monitor 25 and Event Processing Server 100 .
- Event Agent 45 may be adapted to execute on nodes running any commercially prevalent operating system such as UNIX, LINUX, Windows NT, and others.
- Event Agent 45 may execute on the same physical machine as Reference Monitor 25 , or on a different physical machine (not shown) if the machines are networked. If Event Agent 45 and Reference Monitor 25 execute on different physical machines, they will preferably communicate via any secure network protocol that supports message integrity and authentication, such as HTTPS and others. Secure network protocols are desirable so that Event Agent 45 and Reference Monitor 25 can validate the origin and content of communication received.
- Event Processing Server 100 is a software application in communication with one or more Event Agents 45 , and may execute on a workstation or server residing within the same sub-network as Event Agents 45 , or on a different sub-network connected via a router, gateway or other component. Data transport between Event Agent 45 and Event Processing Server 100 may be accomplished via such secure communication protocols as HTTPS and/or others.
- Event Processing Server 100 consists of integrated software components Transceiver 115 , Loader 125 , Instruction Engine 135 , Correlation Engine 145 , and Electronic File Storage 155 . Transceiver 115 receives event notifications from Event Agent 45 and prepares them for processing.
- Electronic File Storage 155 is a database organized to provide a constantly updated representation of the status of Event Agents 45 in quickly accessible form.
- Instruction Engine 135 and Correlation Engine 145 process data in Electronic File Storage 155 .
- Instruction Engine 135 determines whether individual notifications received from nodes warrant policy updates—for instance, determining whether a notification indicates an active attack (such as a buffer overrun attack) or a passive attack (such as a virus)—and determines steps to be taken, such as placing nodes in quarantine, defining system operations which may not be performed on any machine on which a Reference Monitor 25 executes, or tuning operating system, network, or firewall parameters.
- Event Processing Server 100 passes instructions to be issued to Transceiver 115 , which then transmits them to Event Agent 45 .
- Correlation Engine 145 determines whether event notifications, when considered in combination, warrant policy updates. By continuously tracking and analyzing the activity reported by various event agents across one or more networks, Event Processing Server 100 is able to correlate events that may seem unrelated across the distributed system to recognize potential attacks. Attacks may be defined by combinations of events, such as attempting to access a particular resource together with writing a particular file. Other relationships between time and machine resources accessed may also signify an attack.
- Reference Monitor 25 , Event Agent 45 , and Event Processing Server 100 may interact in various ways to provide local protection of individual nodes, remote adaptive protection of one or more nodes, and correlative protection for one or more nodes, as described in detail below.
- Reference Monitor 25 Local protection of individual nodes is provided by Reference Monitor 25 .
- an instruction arrives in 10 from Network 5 to Application 15 , which may be an e-mail, browser, terminal server, or other software application running on Node A.
- This network-based instruction received in 10 causes Application 15 to issue a corresponding request in 20 for System Resources 35 (i.e., access to disk or CPU), which is detected and routed through Reference Monitor 25 .
- System Resources 35 i.e., access to disk or CPU
- the Reference Monitor allows Application 15 access to System Resources 35 in 30 . If the request violates these policies, Reference Monitor 25 may prevent Application 15 from accessing System Resources 35 in 30 .
- Reference Monitor 25 may work in conjunction with Event Agent 45 and Event Processing Server 100 to provide remote adaptive protection in addition to, or instead of, local protection. Also depicted in FIG. 1, Reference Monitor 25 may perform basic analysis on the instruction arriving in 10 and communicate with Event Agent 45 in 40 as to its nature, as defined by current administrative policy. Event Agent 45 then sends a notification via Network 5 in 50 and 110 (which constitute transfer of the same notification) to Event Processing Server 100 as to the nature of the activity. Event Processing Server 100 receives the notification in 110 from Network 5 . Transceiver 115 receives the notification in 110 from Event Agent 45 and prepares it for processing.
- Instruction Engine 135 determines whether an update to administrative policies is warranted, and determines other steps to be taken, including placing Node A in quarantine, defining system operations which may not be performed on Node A, tuning Node A's operating system, or modifying network or firewall parameters.
- An update to administrative policies may be issued in response to a single request to access system resources, or a combination of requests to access system resources, reported by Reference Monitor 25 .
- Instruction Engine 135 issues instructions to update policies on Node A in 160 to Transceiver 115 , which transmits instructions in 180 and 190 via Network 5 to Event Agent 45 .
- Event Agent 45 application in addition to notifying Event Processing Server 100 software as to intercepted operations, Event Agent 45 application will periodically poll Event Processing Server 100 for administrative policy updates at a pre-programmed frequency. It is preferable for Event Agent 45 software to poll Event Processing Server 100 , and not the opposite, for at least one reason. Specifically, the node on which Event Agent 45 executes usually knows the address of Event Processing Server 100 , and the opposite may not be true, particularly if the node is a mobile laptop. However, in some cases, with sufficiently stringent security measures protecting Event Processing Server 100 , it might be safely programmed to poll or broadcast to Event Agents 45 to alert them to administrative policy updates.
- FIG. 2 A second embodiment of remote adaptive protection is depicted in FIG. 2, which illustrates an attack to a single node being diagnosed by Event Processing Server 100 , which then acts to prevent subsequent attacks on another node.
- data which may be a request, message, or other content—arrives at Application 15 A running on Node A.
- Application 15 A may, for instance, be an e-mail application or other application designed to receive data or requests from other nodes on this or other networks.
- Reference Monitor 25 A As described in the foregoing, when Application 15 A attempts to access system resources 35 A in 20 A, the attempt is intercepted by Reference Monitor 25 A.
- Reference Monitor 25 A decides whether the attempt to access resources is acceptable based on pre-programmed policies (in which case it allows resource access in 30 A), and alerts Event Agent 45 A in 40 A as to the attempt.
- Event Agent 45 A transmits a notification to Event Processing Server 100 in 50 A.
- Event Processing Server 100 processes the notification, and determines after loading the data in 130 that the attempt to access resources on Node A should not have been allowed (for instance, by determining that the data arriving from the network was a virus not previously recognized by Reference Monitor 25 A). In 190 B, it transmits instructions to Event Agent 45 B to update administrative policies, so as to restrict access to system resources 35 B.
- System resources 35 A, 35 B may comprise multiple components, each of which may be accessed separately. For example, an e-mail virus may have attempted to access ten components comprising system resources 35 A in sequence, and Event Agent 45 B may attempt to restrict access to a subset of those ten components, all ten components, or those and other components within system resources 35 B.
- Event Agents 45 A, 45 B work in conjunction with Reference Monitor 25 A to determine the components accessed. If Reference Monitor 25 A is a stateful reference monitor, Reference Monitor 25 A recognizes accessed components because it maintains state.
- Event Agent 45 B passes instructions in 41 B to Reference Monitor 25 B, which updates its administrative policies to incorporate these instructions.
- Reference Monitor 25 B having updated its administrative policies, denies this attempt (denoted with an ‘X’ in FIG. 2).
- Event Processing Server 100 prevents potentially damaging activity from affecting more than one node on the network, by identifying possibly malicious instructions or requests and preventing them from being executed through updates to administrative policy, preferably in real time.
- FIG. 3 An example of correlative protection is depicted in FIG. 3, which depicts processing of notifications received from multiple nodes to determine that an attack is in progress, and preventing subsequent similar activity on other nodes.
- data which may be a request, message, or other content —arrives at Applications 15 A and 16 B, running on Nodes A and B, respectively.
- Applications 15 A and 16 B may, for instance, be e-mail applications or other application designed to receive data or requests from other nodes on this or other networks, but Applications 15 A and 16 B need not be the same application.
- Event Processing Server 100 which in this embodiment includes a Correlation Engine 145 component as depicted in FIG. 1, processes data in Electronic File Storage 155 to determine, by comparing monitored activity to pre-programmed combinations and timeframes, that the actions on Nodes A and B represents possibly harmful activity.
- Event Agents 45 D and 45 E running on Nodes D and E receive these notifications, and pass instructions to respective Reference Monitors 25 D and 25 E to update administrative policies in 41 D and 41 E respectively.
- Event Agents 45 A and 45 B receive these notifications as well, and pass instructions to Reference Monitors 25 A and 25 B to update administrative policies in 41 A and 41 E, respectively.
- instructions may include administrative policy changes specific to certain nodes, placing a particular node in quarantine, tuning network or firewall parameters, or other instructions.
- Reference Monitors 25 D and 25 E implement the updated administrative policy, so that when subsequent network requests arrive at Applications 17 D and 18 E in 10 D and 10 E respectively, requests for System Resources 35 D and 35 E are denied (denoted with an ‘X’ in FIG. 3).
- Event Processing Server 100 discerns that activity occurring on multiple workstations, when considered in combination, represents potentially malicious or harmful events, and transmits instructions to prevent the activity from subsequently affecting one or more other nodes on the network, in real time.
- Event Processing Server 100 also disseminates instructions, such as policy updates or network parameter modifications, when polled by Event Agents 45 . However, in certain embodiments and/or emergency situations, Event Processing Server 100 may transmit unsolicited instructions to one or more Event Agents 45 to update administrative policies.
- Event Processing Server 100 sends a notification to relevant Event Agents 45 enabling pre-programmed security measures, although in other embodiments Event Processing Server 100 may issue instructions to impose new measures based upon an analysis of activity observed by Event Agents 45 .
- Security measure updates are preferably performed in real time, by issuing instructions to some number of Event Agents 45 , so as to thwart an observed attack as quickly as possible.
- Event Agent(s) 45 in addition to notifying Event Processing Server 100 of activity detected by Reference Monitor(s) 25 , may also notify other entities.
- Event Agent(s) 45 may notify network administration staff about the activity by pager, e-mail, SNMP trap, message to any other server or console, SMS message, or other communication method.
- Event Agent(s) 45 may notify software applications or other programmed components residing on the network of detected activity. For instance, Event Agent 45 may notify a firewall application, so that the firewall's configuration can be updated.
- Event Processing Server 100 may also notify these entities using these or other communication methods, either before or after issuing resulting instructions to Event Agents 45 .
- Embodiments of the invention may be configured such that certain event processing servers communicate with other event processing servers to provide protection for a larger community of nodes on the network.
- Nodes A, B are in communication 10 , 20 with Server C, which they notify upon recognizing changes in state
- Nodes D, E are in communication 30 , 40 with Server F, which they notify upon recognizing changes in state.
- Servers C, F are in communication 60 , 70 with Server G.
- Server G may or may not be in communication with still other servers (not shown).
- Servers C or F upon being notified of a change in state by a node with which they are in communication, communicate the change in state and/or resulting administrative policy modifications to Server G, so that instructions and/or updates may be disseminated to other servers and/or other nodes.
- Various embodiments will have various communication structures in place.
- the “hierarchical” communication structure comprised of Servers C and F in exclusive communication 60 , 70 with Server G may be replaced or supplemented by a “flat” structure comprised of Servers C and F in communication 50 with each other, so that notification need not travel through Server G to reach other servers on the network.
- Various embodiments may employ a hierarchical structure, a flat structure, or a combination of both.
Abstract
Description
- This application claims priority to provisional U.S. application Serial No. 60/298,592 filed Jun. 14, 2001 and entitled Stateful Distributed Event Processing and Adaptive Security, the disclosures of which are incorporated herein by reference.
- This application is also related to co-pending U.S. application Ser. No. 10/071,328 filed Feb. 8, 2002 and entitled Stateful Reference Monitor, the disclosures of which are incorporated herein by reference.
- This invention relates to computer network security, and more particularly to methods and apparatus for securing one or more nodes on a computer network.
- Conventional network security systems can be said to provide either “active” or “passive” protection. Active security systems provide real-time barriers to intrusions, via software- or hardware-based pre-programmed intrusion detection measures. “Passive” systems provide the ability to detect and recover from previously observed security breaches, by examining data gathered about previous system access activity, so as to improve static access controls and policies over time. Active systems, then, function primarily to prevent intrusions, and passive systems function primarily to report on and examine data about previous intrusions to prevent future intrusions.
- Examples of conventional active security systems include access control tools, content filtering tools, and system auditing tools. Access control tools, such as network firewalls, can be deployed on dedicated machines, usually at a network perimeter, to control inbound and outbound access using pre-configured permission levels. Content filtering tools, like computer virus scanners, typically execute on either an e-mail server or a workstation, and function by screening incoming content, like e-mail and attached files, for potentially threatening matter, based on known signatures of previously observed attacks. System auditing tools, like reference monitors, may provide either stateless or state-based monitoring (such as the state-based monitoring provided by the stateful reference monitor described in U.S. patent application Ser. No. 10/071,328 and incorporated by reference herein) of individual workstations or servers, by identifying variations from either pre-determined settings or a dynamic machine state.
- Examples of conventional passive security systems include activity logging tools and auditing tools, which may be employed in conjunction with one another. Activity logging tools track the activity of one or more computers and transcribe observed system activity to a series of log files as individual entries. Auditing tools typically examine those log entries to discern breaches, attacks, or other potentially threatening activity, occurring either across machines or within individual machines.
- Both types of security systems provide useful intrusion detection and prevention functions. However, both generally rely on pre-programmed network administration policy, business rules, or other parameters, and so neither (particularly passive systems) provides the adaptation capability sometimes necessary to counter novel types of attacks as they occur. Also, conventional active systems are unable to observe and correlate seemingly innocuous activity as it occurs across nodes to determine that an intrusion is in progress. Given the growing ubiquity of computer networks and the value of electronic assets, commensurate growth of network security threats is to be expected. Therefore, a security system which provides adaptive countermeasures in real time to localized (i.e., limited to one node) or non-localized intrusions would provide tremendous value to operators of computer networks.
- A first embodiment of the invention provides a method of maintaining a networked computer system including first and second nodes and an event processing server, comprising the first and second nodes detecting changes in state, the event processing server receiving notification of the changes in state from the first and second nodes, the event processing server correlating changes in state detected in the first and second nodes, and the event processing server executing a maintenance decision which affects the first and second nodes, wherein the detecting, transmitting, correlating, and executing occurs without human intervention.
- This embodiment may be practiced wherein the changes in state are a result of at least one of an event and the absence of an event, wherein the changes in state are recognized by a reference monitor, and/or wherein the event processing server receiving the report is the result of one of the first and second nodes reporting to the event processing server and the event processing server polling the first and second nodes. The embodiment may further include the event processing server updating an operating policy on the network, and updating the operating policy may include at least one of requesting security policy changes on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters. At least one node may further enact the updated operating policy. Also, the embodiment may further include notifying an external entity of actions taken, and the external entity may be a network administrator or a software application executing on the network.
- A second embodiment of the invention provides a method for maintaining a networked computer system including at least one node detecting a change in state, an event processing server on the network receiving notification of the at least one change in state from the at least one node, and the event processing server responding to the notification by executing a maintenance decision, wherein the detecting, receiving, and responding occurs without human intervention.
- This embodiment may be practiced wherein the change in state is a result of at least one of an event and the absence of an event, wherein the change in state is recognized by a reference monitor, wherein the event processing server receiving the report is the result of one of the node reporting to the event processing server and the event processing server polling the node, and may be practiced wherein the maintenance decision affects the at least one node detecting the change in state, and/or wherein the maintenance decision affects at least one node other than the node detecting the change in state. The embodiment may further include the event processing server updating an operating policy on the network, wherein updating the operating policy may include at least one of requesting security policy changes on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters. The embodiment may still further include at least one node enacting the updated operating policy, and/or notifying an external entity of actions taken, wherein the external entity is a network administrator or a software application executing on the network.
- A third embodiment of the invention provides a method for maintaining a node on a networked computer system including at least one node detecting a change in state, and the at least one node reacting to the change in state, wherein the at least one node detecting and reacting occurs without human intervention.
- The embodiment may be practiced wherein the change in state is a result of at least one of an event and the absence of an event, and/or wherein the change in state is recognized by a stateful reference monitor. The embodiment may further include at least one node notifying an event processing server on the network, the event processing server responding to the notification by updating an operating policy on the network, wherein updating the operating policy includes at least one of requesting updates to security policy on at least one node, requesting changes to privileges to access system resources on at least one node, tuning system parameters on at least one node, and modifying network firewall parameters. The embodiment may further include the at least one node enacting the updated operating policy, and/or notifying an external entity of actions taken, wherein the external entity is a network administrator and/or a software application executing on the network.
- A fourth embodiment of the invention provides a computer-readable medium having instructions recorded thereon, which instructions, when executed, enable at least one processor in a networked computer system to detect a change in state of a node, and process instructions defining reacting to the detected change in state.
- The embodiment may further include instructions defining communicating the change in state to an event processing server, instructions defining processing maintenance instructions received from the event processing server, and/or instructions defining transmitting notification to a network administrator of actions taken.
- A fifth embodiment of the invention provides a computer-readable medium having instructions recorded thereon, which instructions, when executed, enable at least one processor in a networked computer system to maintain an operating policy for the network, receive notification of a change in state from at least one node, and update the operating policy based on the change in state.
- The embodiment may further include instructions defining storing received notifications of changes in state in memory, instructions defining correlating notifications received from a plurality of nodes, instructions defining storing received notifications in electronic file storage, and/or instructions defining notifying an external entity of actions taken, wherein the external entity is a network administrator or a software application executing on the network.
- A sixth embodiment of the invention provides a method for maintaining a networked computer system including at least one node detecting a change in state, an event processing server on the network receiving notification of the at least one change in state from the at least one node, and the event processing server responding to the notification by dispensing a maintenance decision.
- The embodiment may further comprise executing, by a human operator, the maintenance decision on at least one node on the networked computer system, or executing, without human intervention, the maintenance decision on at least one node on the networked computer system. A human operator may be prompted and allotted a predetermined period to execute the maintenance decision before it is executed without human intervention.
- FIG. 1 is a functional block diagram depicting the interaction of system components which define aspects of at least one embodiment of the invention;
- FIG. 2 is a functional block diagram depicting the interaction of system components which define aspects of at least one other embodiment of the invention;
- FIG. 3 is a functional block diagram depicting the interaction of system components which define aspects of at least a third embodiment of the invention;
- FIG. 4 is a block diagram of an exemplary computer system on which aspects of embodiments of the invention may be implemented; and
- FIG. 5 is a block diagram depicting exemplary computer system components with which aspects of embodiments of the invention may be implemented.
- Aspects of embodiments of the present invention provide methods and apparatus for securing a networked computer system through the coordinated execution of reference monitor and event agent software on individual nodes, and event processing server software on a network server, for achieving active security measures, administrative control, and the ability to correlate potentially threatening activity across multiple nodes in real time.
-
Computer system 400, shown in FIG. 4, with which aspects of these embodiments, either individually or in combination, may be implemented, may include at least one main unit connected to both one ormore output devices 401 which store information, transmit information or display information to one or more users or machines, and one ormore input devices 402 which receives input from one or more users or machines. The main unit may include one ormore processors 403 connected to amemory system 404 via one ormore interconnection mechanisms 405, such as a bus or switch. Anyinput device 402 and/oroutput device 401 are also connected to theprocessor 403 andmemory system 404 via theinterconnection mechanism 405. Thecomputer system 400 may further include astorage system 406 in which information is held on or in a non-volatile medium. The medium may be fixed in the system or may be removable. - Alternatively,
computer system 400 may be distributed, and therefore may not include a main unit. In particular,input devices 402,processors 403,memory systems 404,interconnection mechanisms 405, andstorage systems 406 may each comprise individual or multiple computer systems, and may be geographically disparate. For example,storage systems 406 may comprise a server farm residing in New York which communicates with aprocessor 403 residing in Pennsylvania, via the Internet, which serves asinterconnection mechanism 405. -
Computer system 400 may be a general purpose computer system which is programmable using a computer programming language. Computer programming languages suitable for implementing such a system include procedural programming languages, object-oriented programming languages, combinations of the two, or other languages. The computer system may also be specially programmed, special purpose hardware, or an application specific integrated circuit (ASIC). - In a general purpose computer system, the processor is typically a commercially available processor which executes a program called an operating system, which controls the execution of other computer programs and provides scheduling, debugging, input/output control, accounting, compilation, storage assignment, data management, memory management, communication control and related services. The processor and operating system defines the platform for which application programs in other computer programming languages are written. The invention is not limited to any particular processor, operating system or programming language.
-
Storage system 406, shown in greater detail in FIG. 5, typically includes a computer-readable and computer-writeablenon-volatile recording medium 501, in which data is stored that define a program to be executed by the processor, or information stored to be processed by the program. The medium may, for example, be a disk or flash memory. Typically, in operation, the processor causes data to be read from thenonvolatile recording medium 501 into anothermemory 502 that allows for faster access to the information by the processor than does the medium 501. Thismemory 502 is typically a volatile, random access memory such as a dynamic random access memory (DRAM) or static memory (SRAM). It may be located instorage system 406, as shown, or inmemory system 404, not shown. Theprocessor 403 generally manipulates the data within the integratedcircuit memory circuit memory element particular memory system 404 orstorage system 406. - Aspects of embodiments of the invention may be implemented in software, hardware or firmware, or any combination thereof. The various elements of an embodiment, either individually or in combination, may be implemented as a computer program product including a computer-readable medium,
e.g. storage 406, on which instructions are stored for access and execution by a processor,e.g. processor 403. When executed by theprocessor 403, the instructions instruct theprocessor 403 to perform the various steps of the process. - FIG. 1 is a functional block diagram depicting the relationship between system components, such as those described above, adapted to enable aspects of embodiments of the invention.
-
Reference Monitor 25 executes on Node A, which may be a workstation, server, or other computer on the network.Reference Monitor 25 may be a software application, which may execute on Node A synchronously, asynchronously, or both, providing continuous monitoring capability.Reference Monitor 25 may be adapted to execute on nodes running any commercially prevalent operating system such as UNIX, LINUX, Windows NT, and others.Reference Monitor 25 acts to detect and intercept local node operations and/or network-originated requests through which the operating system and/or user applications attempt to access system resources on the node. In some embodiments, in order to monitor system events,Reference Monitor 25 comprisesInterceptors 26, which are inserted in the control or communication paths traversed by those events. For example, if an particular monitored event is a network access request, anInterceptor 26 may be inserted in the operating system at a point where the network access request is communicated from one portion of the operating system to another.Interceptor 26 may generate an event message for each event intercepted. Event messages may then be communicated toReference Monitor 25, which may return a policy message toInterceptor 26. The policy message may be an action forInterceptor 26 to take, such as allowing an access request event to continue along the control or communication path so that it has its intended effect, or not allowing the event to pass along the path.Reference Monitor 25 may instead, or also, construe the absence of an anticipated request for system resources as a harmful activity. In these embodiments,Reference Monitor 25 may interpret an overall absence of event messages, of certain types of event messages, or of event messages received within a certain timeframe, for example, as cause to return a policy message toInterceptor 26, such as an instruction to not to allow an event to continue along its intended path. -
Event Agent 45 also executes on Node A, and in this embodiment is a software application which executes continuously in the background on NodeA. Event Agent 45 executes in conjunction with, and may be integrated with,Reference Monitor 25 and coordinates communication betweenReference Monitor 25 andEvent Processing Server 100.Event Agent 45 may be adapted to execute on nodes running any commercially prevalent operating system such as UNIX, LINUX, Windows NT, and others.Event Agent 45 may execute on the same physical machine asReference Monitor 25, or on a different physical machine (not shown) if the machines are networked. IfEvent Agent 45 andReference Monitor 25 execute on different physical machines, they will preferably communicate via any secure network protocol that supports message integrity and authentication, such as HTTPS and others. Secure network protocols are desirable so thatEvent Agent 45 andReference Monitor 25 can validate the origin and content of communication received. -
Event Processing Server 100, in this embodiment, is a software application in communication with one ormore Event Agents 45, and may execute on a workstation or server residing within the same sub-network asEvent Agents 45, or on a different sub-network connected via a router, gateway or other component. Data transport betweenEvent Agent 45 andEvent Processing Server 100 may be accomplished via such secure communication protocols as HTTPS and/or others. In the embodiment depicted,Event Processing Server 100 consists of integratedsoftware components Transceiver 115,Loader 125,Instruction Engine 135,Correlation Engine 145, andElectronic File Storage 155.Transceiver 115 receives event notifications fromEvent Agent 45 and prepares them for processing. Data is passed toLoader 125, which prepares it for loading toElectronic File Storage 155. In a preferred embodiment,Electronic File Storage 155 is a database organized to provide a constantly updated representation of the status ofEvent Agents 45 in quickly accessible form.Instruction Engine 135 andCorrelation Engine 145 process data inElectronic File Storage 155.Instruction Engine 135 determines whether individual notifications received from nodes warrant policy updates—for instance, determining whether a notification indicates an active attack (such as a buffer overrun attack) or a passive attack (such as a virus)—and determines steps to be taken, such as placing nodes in quarantine, defining system operations which may not be performed on any machine on which aReference Monitor 25 executes, or tuning operating system, network, or firewall parameters.Instruction Engine 135 passes instructions to be issued toTransceiver 115, which then transmits them toEvent Agent 45.Correlation Engine 145 determines whether event notifications, when considered in combination, warrant policy updates. By continuously tracking and analyzing the activity reported by various event agents across one or more networks,Event Processing Server 100 is able to correlate events that may seem unrelated across the distributed system to recognize potential attacks. Attacks may be defined by combinations of events, such as attempting to access a particular resource together with writing a particular file. Other relationships between time and machine resources accessed may also signify an attack. -
Reference Monitor 25,Event Agent 45, andEvent Processing Server 100 may interact in various ways to provide local protection of individual nodes, remote adaptive protection of one or more nodes, and correlative protection for one or more nodes, as described in detail below. - Local protection of individual nodes is provided by
Reference Monitor 25. In the embodiment depicted in FIG. 1, an instruction arrives in 10 fromNetwork 5 toApplication 15, which may be an e-mail, browser, terminal server, or other software application running on Node A. This network-based instruction received in 10causes Application 15 to issue a corresponding request in 20 for System Resources 35 (i.e., access to disk or CPU), which is detected and routed throughReference Monitor 25. If the request does not violate pre-programmed administrative policies, which in the embodiment shown are stored as coded instructions within the Reference Monitor or in a database onhard disk 35, the Reference Monitor allowsApplication 15 access toSystem Resources 35 in 30. If the request violates these policies,Reference Monitor 25 may preventApplication 15 from accessingSystem Resources 35 in 30. -
Reference Monitor 25 may work in conjunction withEvent Agent 45 andEvent Processing Server 100 to provide remote adaptive protection in addition to, or instead of, local protection. Also depicted in FIG. 1,Reference Monitor 25 may perform basic analysis on the instruction arriving in 10 and communicate withEvent Agent 45 in 40 as to its nature, as defined by current administrative policy.Event Agent 45 then sends a notification viaNetwork 5 in 50 and 110 (which constitute transfer of the same notification) toEvent Processing Server 100 as to the nature of the activity.Event Processing Server 100 receives the notification in 110 fromNetwork 5.Transceiver 115 receives the notification in 110 fromEvent Agent 45 and prepares it for processing. This data is then passed in 120 toLoader 125, which prepares it for loading, and in 130 initiates the load of the data toElectronic File Storage 155. Once loaded,Instruction Engine 135 andCorrelation Engine 145 process the data inElectronic File Storage 155 in 140 and 150, respectively.Instruction Engine 135 determines whether an update to administrative policies is warranted, and determines other steps to be taken, including placing Node A in quarantine, defining system operations which may not be performed on Node A, tuning Node A's operating system, or modifying network or firewall parameters. An update to administrative policies may be issued in response to a single request to access system resources, or a combination of requests to access system resources, reported byReference Monitor 25.Instruction Engine 135 issues instructions to update policies on Node A in 160 toTransceiver 115, which transmits instructions in 180 and 190 viaNetwork 5 toEvent Agent 45. - In certain embodiments, in addition to notifying
Event Processing Server 100 software as to intercepted operations,Event Agent 45 application will periodically pollEvent Processing Server 100 for administrative policy updates at a pre-programmed frequency. It is preferable forEvent Agent 45 software to pollEvent Processing Server 100, and not the opposite, for at least one reason. Specifically, the node on whichEvent Agent 45 executes usually knows the address ofEvent Processing Server 100, and the opposite may not be true, particularly if the node is a mobile laptop. However, in some cases, with sufficiently stringent security measures protectingEvent Processing Server 100, it might be safely programmed to poll or broadcast toEvent Agents 45 to alert them to administrative policy updates. - A second embodiment of remote adaptive protection is depicted in FIG. 2, which illustrates an attack to a single node being diagnosed by
Event Processing Server 100, which then acts to prevent subsequent attacks on another node. In 10A, data—which may be a request, message, or other content—arrives atApplication 15A running onNode A. Application 15A may, for instance, be an e-mail application or other application designed to receive data or requests from other nodes on this or other networks. As described in the foregoing, whenApplication 15A attempts to accesssystem resources 35A in 20A, the attempt is intercepted byReference Monitor 25A.Reference Monitor 25A decides whether the attempt to access resources is acceptable based on pre-programmed policies (in which case it allows resource access in 30A), andalerts Event Agent 45A in 40A as to the attempt.Event Agent 45A transmits a notification toEvent Processing Server 100 in 50A. -
Event Processing Server 100 processes the notification, and determines after loading the data in 130 that the attempt to access resources on Node A should not have been allowed (for instance, by determining that the data arriving from the network was a virus not previously recognized byReference Monitor 25A). In 190B, it transmits instructions toEvent Agent 45B to update administrative policies, so as to restrict access tosystem resources 35B.System resources system resources 35A in sequence, andEvent Agent 45B may attempt to restrict access to a subset of those ten components, all ten components, or those and other components withinsystem resources 35B.Event Agents Reference Monitor 25A to determine the components accessed. IfReference Monitor 25A is a stateful reference monitor,Reference Monitor 25A recognizes accessed components because it maintains state. -
Event Agent 45B passes instructions in 41B toReference Monitor 25B, which updates its administrative policies to incorporate these instructions. When data arrives from the network in 10B toApplication 16B, which need not be the same application asapplication 15A, a similar attempt to access system resources is initiated in 20B.Reference Monitor 25B, having updated its administrative policies, denies this attempt (denoted with an ‘X’ in FIG. 2). In this manner,Event Processing Server 100 prevents potentially damaging activity from affecting more than one node on the network, by identifying possibly malicious instructions or requests and preventing them from being executed through updates to administrative policy, preferably in real time. - An example of correlative protection is depicted in FIG. 3, which depicts processing of notifications received from multiple nodes to determine that an attack is in progress, and preventing subsequent similar activity on other nodes. As in the foregoing embodiments, in10A and 10B, data—which may be a request, message, or other content —arrives at
Applications Applications Applications Applications system resources respective Reference Monitors Reference Monitors Event Agents Event Agents Event Processing Server 100, which loads it toElectronic File Storage 155 for processing. -
Event Processing Server 100, which in this embodiment includes aCorrelation Engine 145 component as depicted in FIG. 1, processes data inElectronic File Storage 155 to determine, by comparing monitored activity to pre-programmed combinations and timeframes, that the actions on Nodes A and B represents possibly harmful activity.Event Agents respective Reference Monitors embodiments Event Agents Reference Monitors Reference Monitors Applications System Resources Event Processing Server 100 discerns that activity occurring on multiple workstations, when considered in combination, represents potentially malicious or harmful events, and transmits instructions to prevent the activity from subsequently affecting one or more other nodes on the network, in real time. - In certain embodiments,
Event Processing Server 100 also disseminates instructions, such as policy updates or network parameter modifications, when polled byEvent Agents 45. However, in certain embodiments and/or emergency situations,Event Processing Server 100 may transmit unsolicited instructions to one ormore Event Agents 45 to update administrative policies. - In certain embodiments,
Event Processing Server 100 sends a notification torelevant Event Agents 45 enabling pre-programmed security measures, although in other embodimentsEvent Processing Server 100 may issue instructions to impose new measures based upon an analysis of activity observed byEvent Agents 45. Security measure updates are preferably performed in real time, by issuing instructions to some number ofEvent Agents 45, so as to thwart an observed attack as quickly as possible. - In certain embodiments, Event Agent(s)45, in addition to notifying
Event Processing Server 100 of activity detected by Reference Monitor(s) 25, may also notify other entities. In one example, Event Agent(s) 45 may notify network administration staff about the activity by pager, e-mail, SNMP trap, message to any other server or console, SMS message, or other communication method. In another example, Event Agent(s) 45 may notify software applications or other programmed components residing on the network of detected activity. For instance,Event Agent 45 may notify a firewall application, so that the firewall's configuration can be updated.Event Processing Server 100 may also notify these entities using these or other communication methods, either before or after issuing resulting instructions toEvent Agents 45. - Embodiments of the invention may be configured such that certain event processing servers communicate with other event processing servers to provide protection for a larger community of nodes on the network. As depicted in FIG. 6, Nodes A, B are in
communication communication communication - Various embodiments will have various communication structures in place. For instance, the “hierarchical” communication structure comprised of Servers C and F in
exclusive communication communication 50 with each other, so that notification need not travel through Server G to reach other servers on the network. Various embodiments may employ a hierarchical structure, a flat structure, or a combination of both. - While the invention has been particularly shown and described with reference to specific embodiments, and variations thereon have been indicated, it will be understood by those skilled in the art that various additional changes in form and detail may be made therein without departing from the spirit and scope of the invention, as defined by the following claims.
Claims (50)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/172,305 US7594267B2 (en) | 2001-06-14 | 2002-06-14 | Stateful distributed event processing and adaptive security |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US29859201P | 2001-06-14 | 2001-06-14 | |
US10/172,305 US7594267B2 (en) | 2001-06-14 | 2002-06-14 | Stateful distributed event processing and adaptive security |
Publications (2)
Publication Number | Publication Date |
---|---|
US20020194495A1 true US20020194495A1 (en) | 2002-12-19 |
US7594267B2 US7594267B2 (en) | 2009-09-22 |
Family
ID=23151180
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/172,305 Active 2024-07-21 US7594267B2 (en) | 2001-06-14 | 2002-06-14 | Stateful distributed event processing and adaptive security |
Country Status (4)
Country | Link |
---|---|
US (1) | US7594267B2 (en) |
EP (1) | EP1400061B1 (en) |
JP (1) | JP4373779B2 (en) |
WO (1) | WO2002103960A2 (en) |
Cited By (49)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020019797A1 (en) * | 2000-02-16 | 2002-02-14 | Rocky Stewart | Message routing system for enterprise wide electronic collaboration |
US20020059078A1 (en) * | 2000-09-01 | 2002-05-16 | Valdes Alfonso De Jesus | Probabilistic alert correlation |
WO2002103498A2 (en) * | 2001-06-14 | 2002-12-27 | Okena, Inc. | Stateful reference monitor |
WO2003034219A1 (en) * | 2001-10-18 | 2003-04-24 | Bea Systems, Inc. | System and method for implementing an event adapter |
US20040006550A1 (en) * | 2002-05-02 | 2004-01-08 | Mitch Upton | System and method for enterprise application interactions |
US20040006663A1 (en) * | 2002-05-01 | 2004-01-08 | David Wiser | System and method for storing large messages |
US20040015859A1 (en) * | 2002-05-02 | 2004-01-22 | Timothy Potter | Systems and methods for modular component deployment |
US20040019684A1 (en) * | 2002-05-02 | 2004-01-29 | Timothy Potter | Systems and methods for application view transactions |
US20040034859A1 (en) * | 2002-05-02 | 2004-02-19 | Timothy Potter | Shared common connection factory |
US20040049481A1 (en) * | 2002-05-01 | 2004-03-11 | Mike Blevins | Systems and methods for business process plug-in development |
US20040172623A1 (en) * | 2003-03-01 | 2004-09-02 | Bea Systems, Inc. | Systems and methods for multi-view debugging environment |
US20040187127A1 (en) * | 2003-02-25 | 2004-09-23 | Albert Gondi | Systems and methods for transaction chaining |
US20040225995A1 (en) * | 2003-02-28 | 2004-11-11 | Kyle Marvin | Reusable software controls |
US20040236780A1 (en) * | 2003-02-25 | 2004-11-25 | Michael Blevins | Systems and methods for client-side filtering of subscribed messages |
US20040250122A1 (en) * | 2003-05-09 | 2004-12-09 | Chris Newton | Network intelligence system |
US20040250241A1 (en) * | 2003-02-26 | 2004-12-09 | O'neil Edward K. | System and method for dynamic data binding in distributed applications |
US20040268150A1 (en) * | 2003-06-30 | 2004-12-30 | Aaron Jeffrey A | Network firewall policy configuration facilitation |
US20050010902A1 (en) * | 2003-02-25 | 2005-01-13 | Bea Systems, Inc. | Systems and methods extending an existing programming language with constructs |
US20050021689A1 (en) * | 2003-02-26 | 2005-01-27 | Kyle Marvin | Systems and methods for creating network-based software services using source code annotations |
US20050022164A1 (en) * | 2003-02-25 | 2005-01-27 | Bea Systems, Inc. | Systems and methods utilizing a workflow definition language |
US20050044173A1 (en) * | 2003-02-28 | 2005-02-24 | Olander Daryl B. | System and method for implementing business processes in a portal |
US20050149526A1 (en) * | 2002-06-27 | 2005-07-07 | Bea Systems, Inc. | Systems and methods for maintaining transactional persistence |
US20050240863A1 (en) * | 2003-02-25 | 2005-10-27 | Olander Daryl B | System and method for structuring distributed applications |
US20060136986A1 (en) * | 2004-12-17 | 2006-06-22 | Doolittle Robert W | Enterprise security monitoring system and method |
US20070027975A1 (en) * | 2005-07-29 | 2007-02-01 | Mci, Llc | Policy engine |
US20070074066A1 (en) * | 2002-05-01 | 2007-03-29 | Bea Systems, Inc. | High availability for event forwarding |
US20070150598A1 (en) * | 2002-05-02 | 2007-06-28 | Bea Systems, Inc. | System and method for providing highly available processing of asynchronous service requests |
US20070191969A1 (en) * | 2006-02-13 | 2007-08-16 | Jianying Shi | Automated state change notification |
US20070277237A1 (en) * | 2006-05-24 | 2007-11-29 | Verizon Business Federal Network Systems Llc | Information operations support system, method, and computer program product |
US20070283192A1 (en) * | 2006-02-08 | 2007-12-06 | Sergei Shevchenko | Automated threat analysis |
US7716473B1 (en) * | 2004-04-09 | 2010-05-11 | Cisco Technology, Inc. | Methods and apparatus providing a reference monitor simulator |
US20100153345A1 (en) * | 2008-12-12 | 2010-06-17 | Thilo-Alexander Ginkel | Cluster-Based Business Process Management Through Eager Displacement And On-Demand Recovery |
EP2013738A4 (en) * | 2006-05-01 | 2011-07-13 | Cisco Tech Inc | Methods and apparatus providing computer and network security utilizing probabilistic policy reposturing |
US8015572B2 (en) | 2002-02-22 | 2011-09-06 | Oracle International Corporation | Systems and methods for an extensible software proxy |
US8032860B2 (en) | 2003-02-26 | 2011-10-04 | Oracle International Corporation | Methods for type-independent source code editing |
US8135772B2 (en) | 2002-05-01 | 2012-03-13 | Oracle International Corporation | Single servlets for B2B message routing |
US20130232338A1 (en) * | 2005-10-05 | 2013-09-05 | Byres Security | Network security appliance |
US20140165200A1 (en) * | 2011-07-29 | 2014-06-12 | Anurag Singla | Systems and methods for distributed rule-based correlation of events |
US20140289133A1 (en) * | 2010-06-28 | 2014-09-25 | Dresser, Inc. | Multimode retail system |
US20140317677A1 (en) * | 2013-04-19 | 2014-10-23 | Vmware, Inc. | Framework for coordination between endpoint security and network security services |
US9547533B2 (en) | 2012-10-15 | 2017-01-17 | Optum Soft, Inc. | Efficient reliable distributed flow-controlled event propagation |
US10061629B2 (en) | 2015-07-22 | 2018-08-28 | Optumsoft, Inc. | Compact binary event log generation |
US20200374189A1 (en) * | 2011-01-10 | 2020-11-26 | Snowflake Inc. | Distributed cloud agents for managing cloud services |
US20210152446A1 (en) * | 2019-11-14 | 2021-05-20 | Trideum Corporation | Systems and methods of monitoring and controlling remote assets |
CN113543096A (en) * | 2015-07-08 | 2021-10-22 | 联邦快递服务公司 | Event monitoring of event candidates related to ID nodes in a wireless node network |
US20220078204A1 (en) * | 2020-09-08 | 2022-03-10 | Sharp Kabushiki Kaisha | Communication control system, information processing apparatus, and communication control method |
US11468167B2 (en) * | 2013-11-13 | 2022-10-11 | Proofpoint, Inc. | System and method of protecting client computers |
US11514159B2 (en) * | 2012-03-30 | 2022-11-29 | Irdeto B.V. | Method and system for preventing and detecting security threats |
US11930035B2 (en) * | 2020-09-08 | 2024-03-12 | Sharp Kabushiki Kaisha | Communication control system, information processing apparatus, and communication control method |
Families Citing this family (17)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7747730B1 (en) * | 2002-06-28 | 2010-06-29 | Netfuel, Inc. | Managing computer network resources |
EP1614255B1 (en) * | 2003-04-04 | 2014-09-03 | CA, Inc. | Method and system for discovery of remote agents |
GB0513375D0 (en) * | 2005-06-30 | 2005-08-03 | Retento Ltd | Computer security |
TW200729053A (en) * | 2006-01-20 | 2007-08-01 | Hon Hai Prec Ind Co Ltd | System and method for sending and auditing mails |
US7971251B2 (en) * | 2006-03-17 | 2011-06-28 | Airdefense, Inc. | Systems and methods for wireless security using distributed collaboration of wireless clients |
JP5159071B2 (en) * | 2006-09-01 | 2013-03-06 | キヤノン株式会社 | COMMUNICATION SYSTEM, COMMUNICATION DEVICE, AND ITS CONTROL METHOD |
US8955122B2 (en) * | 2007-04-04 | 2015-02-10 | Sri International | Method and apparatus for detecting malware infection |
CN101674293B (en) * | 2008-09-11 | 2013-04-03 | 阿里巴巴集团控股有限公司 | Method and system for processing abnormal request in distributed application |
EP2352109B1 (en) * | 2008-11-26 | 2018-06-20 | Panasonic Corporation | Monitoring system, program-executing device, monitoring program, recording medium and integrated circuit |
JP5405986B2 (en) * | 2008-11-26 | 2014-02-05 | パナソニック株式会社 | Software update system, management device, recording medium, and integrated circuit |
JP2013523043A (en) | 2010-03-22 | 2013-06-13 | エルアールディシー システムズ、エルエルシー | How to identify and protect the integrity of a source dataset |
JP5960678B2 (en) * | 2011-03-15 | 2016-08-02 | パナソニック株式会社 | Tamper monitoring system, management device, protection control module and detection module |
US9323589B2 (en) | 2012-05-15 | 2016-04-26 | Oracle International Corporation | Self registration of event—consumers/producers and auto discovery |
US9282100B2 (en) * | 2013-12-02 | 2016-03-08 | Cisco Technology, Inc. | Privilege separation |
US10185465B1 (en) * | 2014-03-19 | 2019-01-22 | Symantec Corporation | Techniques for presenting information on a graphical user interface |
FR3023028B1 (en) * | 2014-06-26 | 2017-07-28 | Olivier Robert Gerard Joffray | METHOD FOR PROTECTING GOODS USED BY CERTIFIED COMMUNICATION DEVICES CONNECTED INTO NETWORKS, AND FOR GUARANTEEING THE OPERATIONAL BEHAVIOR OF SAID DEVICES |
US10200387B2 (en) | 2015-11-30 | 2019-02-05 | International Business Machines Corporation | User state tracking and anomaly detection in software-as-a-service environments |
Citations (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4647944A (en) * | 1985-11-25 | 1987-03-03 | U.S. Philips Corporation | Method for the optical recording of information and an optical recording element used in the method |
US5039980A (en) * | 1990-01-26 | 1991-08-13 | Honeywell Inc. | Multi-nodal communication network with coordinated responsibility for global functions by the nodes |
US5107249A (en) * | 1990-10-16 | 1992-04-21 | C & K Systems, Co. | Intrusion detection system having improved immunity to false alarm |
US5761502A (en) * | 1995-12-29 | 1998-06-02 | Mci Corporation | System and method for managing a telecommunications network by associating and correlating network events |
US6282175B1 (en) * | 1998-04-23 | 2001-08-28 | Hewlett-Packard Company | Method for tracking configuration changes in networks of computer systems through historical monitoring of configuration status of devices on the network. |
US6321338B1 (en) * | 1998-11-09 | 2001-11-20 | Sri International | Network surveillance |
US6405250B1 (en) * | 1999-01-25 | 2002-06-11 | Lucent Technologies Inc. | Network management system based on passive monitoring and proactive management for formulation behavior state transition models |
US6412003B1 (en) * | 1996-11-06 | 2002-06-25 | Telefonaktiebolaget Lm Ericsson (Pub) | System and a method for accessing services |
US20020082886A1 (en) * | 2000-09-06 | 2002-06-27 | Stefanos Manganaris | Method and system for detecting unusual events and application thereof in computer intrusion detection |
US6496575B1 (en) * | 1998-06-08 | 2002-12-17 | Gatespace Ab | Application and communication platform for connectivity based services |
US6691244B1 (en) * | 2000-03-14 | 2004-02-10 | Sun Microsystems, Inc. | System and method for comprehensive availability management in a high-availability computer system |
US6839850B1 (en) * | 1999-03-04 | 2005-01-04 | Prc, Inc. | Method and system for detecting intrusion into and misuse of a data processing system |
US6973488B1 (en) * | 2000-03-31 | 2005-12-06 | Intel Corporation | Providing policy information to a remote device |
US6986133B2 (en) * | 2000-04-14 | 2006-01-10 | Goahead Software Inc. | System and method for securely upgrading networked devices |
US6988208B2 (en) * | 2001-01-25 | 2006-01-17 | Solutionary, Inc. | Method and apparatus for verifying the integrity and security of computer networks and implementing counter measures |
Family Cites Families (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
IL114182A (en) * | 1995-06-15 | 2003-03-12 | Checkpoint Software Techn Ltd | Method for controlling computer network security |
JPH10340235A (en) * | 1997-06-06 | 1998-12-22 | Sumitomo Electric Ind Ltd | Network management system, network management device, and computer-readable recording medium in which network management program is recorded |
US6098172A (en) * | 1997-09-12 | 2000-08-01 | Lucent Technologies Inc. | Methods and apparatus for a computer network firewall with proxy reflection |
US6275942B1 (en) | 1998-05-20 | 2001-08-14 | Network Associates, Inc. | System, method and computer program product for automatic response to computer system misuse using active response modules |
JP2001034553A (en) * | 1999-07-26 | 2001-02-09 | Hitachi Ltd | Network access control method and device therefor |
US6671811B1 (en) * | 1999-10-25 | 2003-12-30 | Visa Internation Service Association | Features generation for use in computer network intrusion detection |
-
2002
- 2002-06-14 EP EP02742052A patent/EP1400061B1/en not_active Expired - Lifetime
- 2002-06-14 JP JP2003506143A patent/JP4373779B2/en not_active Expired - Fee Related
- 2002-06-14 US US10/172,305 patent/US7594267B2/en active Active
- 2002-06-14 WO PCT/US2002/018758 patent/WO2002103960A2/en active Application Filing
Patent Citations (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4647944A (en) * | 1985-11-25 | 1987-03-03 | U.S. Philips Corporation | Method for the optical recording of information and an optical recording element used in the method |
US5039980A (en) * | 1990-01-26 | 1991-08-13 | Honeywell Inc. | Multi-nodal communication network with coordinated responsibility for global functions by the nodes |
US5107249A (en) * | 1990-10-16 | 1992-04-21 | C & K Systems, Co. | Intrusion detection system having improved immunity to false alarm |
US5761502A (en) * | 1995-12-29 | 1998-06-02 | Mci Corporation | System and method for managing a telecommunications network by associating and correlating network events |
US6412003B1 (en) * | 1996-11-06 | 2002-06-25 | Telefonaktiebolaget Lm Ericsson (Pub) | System and a method for accessing services |
US6282175B1 (en) * | 1998-04-23 | 2001-08-28 | Hewlett-Packard Company | Method for tracking configuration changes in networks of computer systems through historical monitoring of configuration status of devices on the network. |
US6496575B1 (en) * | 1998-06-08 | 2002-12-17 | Gatespace Ab | Application and communication platform for connectivity based services |
US6708212B2 (en) * | 1998-11-09 | 2004-03-16 | Sri International | Network surveillance |
US6321338B1 (en) * | 1998-11-09 | 2001-11-20 | Sri International | Network surveillance |
US6405250B1 (en) * | 1999-01-25 | 2002-06-11 | Lucent Technologies Inc. | Network management system based on passive monitoring and proactive management for formulation behavior state transition models |
US6839850B1 (en) * | 1999-03-04 | 2005-01-04 | Prc, Inc. | Method and system for detecting intrusion into and misuse of a data processing system |
US6691244B1 (en) * | 2000-03-14 | 2004-02-10 | Sun Microsystems, Inc. | System and method for comprehensive availability management in a high-availability computer system |
US6973488B1 (en) * | 2000-03-31 | 2005-12-06 | Intel Corporation | Providing policy information to a remote device |
US6986133B2 (en) * | 2000-04-14 | 2006-01-10 | Goahead Software Inc. | System and method for securely upgrading networked devices |
US20020082886A1 (en) * | 2000-09-06 | 2002-06-27 | Stefanos Manganaris | Method and system for detecting unusual events and application thereof in computer intrusion detection |
US6988208B2 (en) * | 2001-01-25 | 2006-01-17 | Solutionary, Inc. | Method and apparatus for verifying the integrity and security of computer networks and implementing counter measures |
Cited By (109)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020019797A1 (en) * | 2000-02-16 | 2002-02-14 | Rocky Stewart | Message routing system for enterprise wide electronic collaboration |
US20020161688A1 (en) * | 2000-02-16 | 2002-10-31 | Rocky Stewart | Open market collaboration system for enterprise wide electronic commerce |
US7249157B2 (en) | 2000-02-16 | 2007-07-24 | Bea Systems, Inc. | Collaboration system for exchanging of data between electronic participants via collaboration space by using a URL to identify a combination of both collaboration space and business protocol |
US20020059078A1 (en) * | 2000-09-01 | 2002-05-16 | Valdes Alfonso De Jesus | Probabilistic alert correlation |
US7917393B2 (en) | 2000-09-01 | 2011-03-29 | Sri International, Inc. | Probabilistic alert correlation |
WO2002103498A3 (en) * | 2001-06-14 | 2004-04-15 | Okena Inc | Stateful reference monitor |
US7290266B2 (en) | 2001-06-14 | 2007-10-30 | Cisco Technology, Inc. | Access control by a real-time stateful reference monitor with a state collection training mode and a lockdown mode for detecting predetermined patterns of events indicative of requests for operating system resources resulting in a decision to allow or block activity identified in a sequence of events based on a rule set defining a processing policy |
WO2002103498A2 (en) * | 2001-06-14 | 2002-12-27 | Okena, Inc. | Stateful reference monitor |
US20030093470A1 (en) * | 2001-10-18 | 2003-05-15 | Mitch Upton | System and method for implementing a service adapter |
US7721193B2 (en) | 2001-10-18 | 2010-05-18 | Bea Systems, Inc. | System and method for implementing a schema object model in application integration |
WO2003034219A1 (en) * | 2001-10-18 | 2003-04-24 | Bea Systems, Inc. | System and method for implementing an event adapter |
US7546606B2 (en) * | 2001-10-18 | 2009-06-09 | Bea Systems, Inc. | System and method using a connector architecture for application integration |
US7831655B2 (en) * | 2001-10-18 | 2010-11-09 | Bea Systems, Inc. | System and method for implementing a service adapter |
US7152204B2 (en) | 2001-10-18 | 2006-12-19 | Bea Systems, Inc. | System and method utilizing an interface component to query a document |
US7080092B2 (en) | 2001-10-18 | 2006-07-18 | Bea Systems, Inc. | Application view component for system integration |
US8015572B2 (en) | 2002-02-22 | 2011-09-06 | Oracle International Corporation | Systems and methods for an extensible software proxy |
US8484664B2 (en) | 2002-02-22 | 2013-07-09 | Oracle International Corporation | Systems and methods for an extensible software proxy |
US20070156884A1 (en) * | 2002-05-01 | 2007-07-05 | Bea Systems, Inc. | High availability for event forwarding |
US20040049481A1 (en) * | 2002-05-01 | 2004-03-11 | Mike Blevins | Systems and methods for business process plug-in development |
US20040006663A1 (en) * | 2002-05-01 | 2004-01-08 | David Wiser | System and method for storing large messages |
US20070198467A1 (en) * | 2002-05-01 | 2007-08-23 | Bea Systems, Inc. | System and method for storing large messages |
US8135772B2 (en) | 2002-05-01 | 2012-03-13 | Oracle International Corporation | Single servlets for B2B message routing |
US7257645B2 (en) | 2002-05-01 | 2007-08-14 | Bea Systems, Inc. | System and method for storing large messages |
US20070156922A1 (en) * | 2002-05-01 | 2007-07-05 | Bea Systems, Inc. | High availability for event forwarding |
US20070074066A1 (en) * | 2002-05-01 | 2007-03-29 | Bea Systems, Inc. | High availability for event forwarding |
US7840532B2 (en) | 2002-05-01 | 2010-11-23 | Oracle International Corporation | System and method for storing large messages |
US20040221261A1 (en) * | 2002-05-01 | 2004-11-04 | Mike Blevins | Collaborative business plug-in framework |
US7840611B2 (en) | 2002-05-01 | 2010-11-23 | Oracle International Corporation | High availability for event forwarding |
US7953787B2 (en) | 2002-05-02 | 2011-05-31 | Oracle International Corporation | System and method for providing highly available processing of asynchronous requests using distributed request and response queues and a service processor |
US7676538B2 (en) | 2002-05-02 | 2010-03-09 | Bea Systems, Inc. | Systems and methods for application view transactions |
US7350184B2 (en) | 2002-05-02 | 2008-03-25 | Bea Systems, Inc. | System and method for enterprise application interactions |
US20070150598A1 (en) * | 2002-05-02 | 2007-06-28 | Bea Systems, Inc. | System and method for providing highly available processing of asynchronous service requests |
US20040006550A1 (en) * | 2002-05-02 | 2004-01-08 | Mitch Upton | System and method for enterprise application interactions |
US20040034859A1 (en) * | 2002-05-02 | 2004-02-19 | Timothy Potter | Shared common connection factory |
US20040019684A1 (en) * | 2002-05-02 | 2004-01-29 | Timothy Potter | Systems and methods for application view transactions |
US8046772B2 (en) | 2002-05-02 | 2011-10-25 | Oracle International Corporation | System and method for enterprise application interactions |
US20040015859A1 (en) * | 2002-05-02 | 2004-01-22 | Timothy Potter | Systems and methods for modular component deployment |
US20050149526A1 (en) * | 2002-06-27 | 2005-07-07 | Bea Systems, Inc. | Systems and methods for maintaining transactional persistence |
US7117214B2 (en) | 2002-06-27 | 2006-10-03 | Bea Systems, Inc. | Systems and methods for maintaining transactional persistence |
US7356532B2 (en) | 2002-06-27 | 2008-04-08 | Bea Systems, Inc. | Systems and methods for maintaining transactional persistence |
US20050010902A1 (en) * | 2003-02-25 | 2005-01-13 | Bea Systems, Inc. | Systems and methods extending an existing programming language with constructs |
US7774697B2 (en) | 2003-02-25 | 2010-08-10 | Bea Systems, Inc. | System and method for structuring distributed applications |
US7293038B2 (en) | 2003-02-25 | 2007-11-06 | Bea Systems, Inc. | Systems and methods for client-side filtering of subscribed messages |
US7752599B2 (en) | 2003-02-25 | 2010-07-06 | Bea Systems Inc. | Systems and methods extending an existing programming language with constructs |
US20050240863A1 (en) * | 2003-02-25 | 2005-10-27 | Olander Daryl B | System and method for structuring distributed applications |
US7844636B2 (en) | 2003-02-25 | 2010-11-30 | Oracle International Corporation | Systems and methods for client-side filtering of subscribed messages |
US20050022164A1 (en) * | 2003-02-25 | 2005-01-27 | Bea Systems, Inc. | Systems and methods utilizing a workflow definition language |
US20040236780A1 (en) * | 2003-02-25 | 2004-11-25 | Michael Blevins | Systems and methods for client-side filtering of subscribed messages |
US20040187127A1 (en) * | 2003-02-25 | 2004-09-23 | Albert Gondi | Systems and methods for transaction chaining |
US7707564B2 (en) | 2003-02-26 | 2010-04-27 | Bea Systems, Inc. | Systems and methods for creating network-based software services using source code annotations |
US7650276B2 (en) | 2003-02-26 | 2010-01-19 | Bea Systems, Inc. | System and method for dynamic data binding in distributed applications |
US8032860B2 (en) | 2003-02-26 | 2011-10-04 | Oracle International Corporation | Methods for type-independent source code editing |
US20040250241A1 (en) * | 2003-02-26 | 2004-12-09 | O'neil Edward K. | System and method for dynamic data binding in distributed applications |
US20050021689A1 (en) * | 2003-02-26 | 2005-01-27 | Kyle Marvin | Systems and methods for creating network-based software services using source code annotations |
US20050044173A1 (en) * | 2003-02-28 | 2005-02-24 | Olander Daryl B. | System and method for implementing business processes in a portal |
US20040225995A1 (en) * | 2003-02-28 | 2004-11-11 | Kyle Marvin | Reusable software controls |
US20040226030A1 (en) * | 2003-02-28 | 2004-11-11 | Kyle Marvin | Systems and methods for an extensible software proxy |
US20040172623A1 (en) * | 2003-03-01 | 2004-09-02 | Bea Systems, Inc. | Systems and methods for multi-view debugging environment |
US7650592B2 (en) | 2003-03-01 | 2010-01-19 | Bea Systems, Inc. | Systems and methods for multi-view debugging environment |
US20040250122A1 (en) * | 2003-05-09 | 2004-12-09 | Chris Newton | Network intelligence system |
US8024795B2 (en) * | 2003-05-09 | 2011-09-20 | Q1 Labs, Inc. | Network intelligence system |
US20120011563A1 (en) * | 2003-05-09 | 2012-01-12 | Chris Newton | Network intelligence system |
US20080172731A1 (en) * | 2003-06-30 | 2008-07-17 | Aaron Jeffrey A | Network firewall policy configuration facilitation |
US7814539B2 (en) * | 2003-06-30 | 2010-10-12 | At&T Intellectual Property I, L.P. | Network firewall policy configuration facilitation |
US7328451B2 (en) * | 2003-06-30 | 2008-02-05 | At&T Delaware Intellectual Property, Inc. | Network firewall policy configuration facilitation |
US20040268150A1 (en) * | 2003-06-30 | 2004-12-30 | Aaron Jeffrey A | Network firewall policy configuration facilitation |
US7716473B1 (en) * | 2004-04-09 | 2010-05-11 | Cisco Technology, Inc. | Methods and apparatus providing a reference monitor simulator |
US20060136986A1 (en) * | 2004-12-17 | 2006-06-22 | Doolittle Robert W | Enterprise security monitoring system and method |
US7975037B2 (en) * | 2005-07-29 | 2011-07-05 | Verizon Patent And Licensing Inc. | Policy engine in an Internet Protocol multimedia subsystem |
US20110231540A1 (en) * | 2005-07-29 | 2011-09-22 | Verizon Patent And Licensing Inc. | Policy engine in an internet protocol multimedia subsystem |
US20070027975A1 (en) * | 2005-07-29 | 2007-02-01 | Mci, Llc | Policy engine |
US8635324B2 (en) * | 2005-07-29 | 2014-01-21 | Verizon Patent And Licensing Inc. | Policy engine in an internet protocol multimedia subsystem |
US9043868B2 (en) * | 2005-10-05 | 2015-05-26 | Byres Security | Network security appliance |
US20130232338A1 (en) * | 2005-10-05 | 2013-09-05 | Byres Security | Network security appliance |
US20070283192A1 (en) * | 2006-02-08 | 2007-12-06 | Sergei Shevchenko | Automated threat analysis |
US20070191969A1 (en) * | 2006-02-13 | 2007-08-16 | Jianying Shi | Automated state change notification |
EP2013738A4 (en) * | 2006-05-01 | 2011-07-13 | Cisco Tech Inc | Methods and apparatus providing computer and network security utilizing probabilistic policy reposturing |
US8554536B2 (en) * | 2006-05-24 | 2013-10-08 | Verizon Patent And Licensing Inc. | Information operations support system, method, and computer program product |
US20070277237A1 (en) * | 2006-05-24 | 2007-11-29 | Verizon Business Federal Network Systems Llc | Information operations support system, method, and computer program product |
US20100153345A1 (en) * | 2008-12-12 | 2010-06-17 | Thilo-Alexander Ginkel | Cluster-Based Business Process Management Through Eager Displacement And On-Demand Recovery |
US11341158B2 (en) | 2008-12-12 | 2022-05-24 | Sap Se | Cluster-based business process management through eager displacement and on-demand recovery |
US9588806B2 (en) * | 2008-12-12 | 2017-03-07 | Sap Se | Cluster-based business process management through eager displacement and on-demand recovery |
US9911266B2 (en) * | 2010-06-28 | 2018-03-06 | Wayne Fueling Systems Llc | Multimode retail system |
US20230146404A1 (en) * | 2010-06-28 | 2023-05-11 | Wayne Fueling Systems Llc | Multimode retail system |
US20140289133A1 (en) * | 2010-06-28 | 2014-09-25 | Dresser, Inc. | Multimode retail system |
US11544988B2 (en) * | 2010-06-28 | 2023-01-03 | Wayne Fueling Systems Llc | Multimode retail system |
US10083564B2 (en) | 2010-06-28 | 2018-09-25 | Wayne Fueling Systems Llc | Multimode retail system |
US20190043300A1 (en) * | 2010-06-28 | 2019-02-07 | Wayne Fueling Systems Llc | Multimode retail system |
US11509526B2 (en) * | 2011-01-10 | 2022-11-22 | Snowflake Inc. | Distributed cloud agents for managing cloud services |
US20200374189A1 (en) * | 2011-01-10 | 2020-11-26 | Snowflake Inc. | Distributed cloud agents for managing cloud services |
US9571508B2 (en) * | 2011-07-29 | 2017-02-14 | Hewlett Packard Enterprise Development Lp | Systems and methods for distributed rule-based correlation of events |
US20140165200A1 (en) * | 2011-07-29 | 2014-06-12 | Anurag Singla | Systems and methods for distributed rule-based correlation of events |
US11514159B2 (en) * | 2012-03-30 | 2022-11-29 | Irdeto B.V. | Method and system for preventing and detecting security threats |
US9547533B2 (en) | 2012-10-15 | 2017-01-17 | Optum Soft, Inc. | Efficient reliable distributed flow-controlled event propagation |
US10511636B2 (en) * | 2013-04-19 | 2019-12-17 | Nicira, Inc. | Framework for coordination between endpoint security and network security services |
US10075470B2 (en) * | 2013-04-19 | 2018-09-11 | Nicira, Inc. | Framework for coordination between endpoint security and network security services |
US11196773B2 (en) * | 2013-04-19 | 2021-12-07 | Nicira, Inc. | Framework for coordination between endpoint security and network security services |
US11736530B2 (en) * | 2013-04-19 | 2023-08-22 | Nicira, Inc. | Framework for coordination between endpoint security and network security services |
US20220094717A1 (en) * | 2013-04-19 | 2022-03-24 | Nicira, Inc. | Framework for coordination between endpoint security and network security services |
US20140317677A1 (en) * | 2013-04-19 | 2014-10-23 | Vmware, Inc. | Framework for coordination between endpoint security and network security services |
US20190014154A1 (en) * | 2013-04-19 | 2019-01-10 | Nicira, Inc. | Framework for coordination between endpoint security and network security services |
US11468167B2 (en) * | 2013-11-13 | 2022-10-11 | Proofpoint, Inc. | System and method of protecting client computers |
CN113543096A (en) * | 2015-07-08 | 2021-10-22 | 联邦快递服务公司 | Event monitoring of event candidates related to ID nodes in a wireless node network |
US10061629B2 (en) | 2015-07-22 | 2018-08-28 | Optumsoft, Inc. | Compact binary event log generation |
US10853157B2 (en) | 2015-07-22 | 2020-12-01 | Optumsoft, Inc. | Compact binary event log generation |
US20210152446A1 (en) * | 2019-11-14 | 2021-05-20 | Trideum Corporation | Systems and methods of monitoring and controlling remote assets |
US11743155B2 (en) * | 2019-11-14 | 2023-08-29 | Trideum Corporation | Systems and methods of monitoring and controlling remote assets |
US20220078204A1 (en) * | 2020-09-08 | 2022-03-10 | Sharp Kabushiki Kaisha | Communication control system, information processing apparatus, and communication control method |
US11930035B2 (en) * | 2020-09-08 | 2024-03-12 | Sharp Kabushiki Kaisha | Communication control system, information processing apparatus, and communication control method |
Also Published As
Publication number | Publication date |
---|---|
EP1400061B1 (en) | 2012-08-08 |
WO2002103960A2 (en) | 2002-12-27 |
WO2002103960A3 (en) | 2003-04-10 |
EP1400061A2 (en) | 2004-03-24 |
JP2005513591A (en) | 2005-05-12 |
JP4373779B2 (en) | 2009-11-25 |
US7594267B2 (en) | 2009-09-22 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7594267B2 (en) | Stateful distributed event processing and adaptive security | |
US11775622B2 (en) | Account monitoring | |
Schnackengerg et al. | Cooperative intrusion traceback and response architecture (CITRA) | |
US10326777B2 (en) | Integrated data traffic monitoring system | |
US9762610B1 (en) | Latency-based policy activation | |
US8230505B1 (en) | Method for cooperative intrusion prevention through collaborative inference | |
US9401924B2 (en) | Monitoring operational activities in networks and detecting potential network intrusions and misuses | |
CA2625718C (en) | Method and system for dynamic adjustment of computer security based on network activity of users | |
EP2599026B1 (en) | System and method for local protection against malicious software | |
US9325725B2 (en) | Automated deployment of protection agents to devices connected to a distributed computer network | |
US7039950B2 (en) | System and method for network quality of service protection on security breach detection | |
US20030084321A1 (en) | Node and mobile device for a mobile telecommunications network providing intrusion detection | |
US20040193943A1 (en) | Multiparameter network fault detection system using probabilistic and aggregation analysis | |
US20100199345A1 (en) | Method and System for Providing Remote Protection of Web Servers | |
US20050203921A1 (en) | System for protecting database applications from unauthorized activity | |
US20100333177A1 (en) | System and method for identifying unauthorized endpoints | |
Kim et al. | DSS for computer security incident response applying CBR and collaborative response | |
GB2381722A (en) | intrusion detection (id) system which uses signature and squelch values to prevent bandwidth (flood) attacks on a server | |
Leelavathy | A Secure Methodology to Detect and Prevent Ddos and Sql Injection Attacks | |
US20220239676A1 (en) | Cyber-safety threat detection system | |
TOUMI et al. | COOPERATIVE TRUST FRAMEWORK BASED ON HY-IDS, FIREWALLS, AND MOBILE AGENTS TO ENHANCE SECURITY IN A CLOUD ENVIRONMENT | |
CN114726562A (en) | Flow filtering method and device, communication equipment and readable storage medium | |
Reddy et al. | Robust IP spoof control mechanism through packet filters | |
Gurbani et al. | A case study on constructing a security event management system | |
White | Cooperating security managers: intrusion detection in a distributed environment |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: OKENA, INC., MASSACHUSETTS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GLADSONE, PHILIP J.S.;KRAEMER, JEFFREY A.;REEL/FRAME:013016/0685 Effective date: 20020614 |
|
AS | Assignment |
Owner name: CISCO SYSTEMS, INC., CALIFORNIA Free format text: MERGER;ASSIGNOR:OKENA, INC.;REEL/FRAME:014266/0805 Effective date: 20030409 |
|
AS | Assignment |
Owner name: CISCO TECHNOLOGY, INC., A CALIFORNIA CORPORATION, Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CISCO SYSTEMS, INC.;REEL/FRAME:014493/0836 Effective date: 20030409 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
FPAY | Fee payment |
Year of fee payment: 4 |
|
FPAY | Fee payment |
Year of fee payment: 8 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 12TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1553); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 12 |